This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to figure out what capture filters were used from a capture file

0

Hi...How can I find out what filters were used when a capture took place and saved in a file? If you get a capture file from someone, can you find out what capture filters were used?...Thanks

asked 12 Jun '15, 14:37

zerowire's gravatar image

zerowire
6224
accept rate: 0%


One Answer:

1

Yes, if the file format for the capture was pcapng, and if the capture tool wrote the capture filter string to the file. You can check by looking at the summary statistic. There's a list of capture interfaces, and one column will tell you the capture filter, if any.

answered 12 Jun '15, 15:11

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Found it. Thank you Jasper so much.

(12 Jun '15, 15:40) zerowire